Environment Variables

Environment Variables

This page catalogs environment variables used by the repo. Values belong in local .env files, Azure DevOps variable groups, or Key Vault. Do not commit real secrets.

Backend

VariableRequiredPurposeSecret
AZURE_OPENAI_ENDPOINTYes for chat featuresAzure OpenAI endpoint for chat/action-point generationNo
AZURE_OPENAI_API_KEYYes for chat featuresAzure OpenAI API keyYes
AZURE_OPENAI_API_VERSIONYes for chat featuresAzure OpenAI API versionNo
AZURE_OPENAI_DEPLOYMENTYes for chat featuresAzure OpenAI deployment nameNo
AZURE_OPENAI_MODELNAMEOptional/configModel name metadataNo
AZURE_OPENAI_EMBEDDINGS_ENDPOINTYes for embeddingsAzure OpenAI embeddings endpointNo
AZURE_OPENAI_EMBEDDINGS_MODELNAMEYes for embeddingsEmbeddings deployment/model nameNo
AZURE_COMPUTER_VISION_ENDPOINTYes for OCRAzure Computer Vision endpointNo
AZURE_COMPUTER_VISION_KEYYes for OCRAzure Computer Vision keyYes
AZURE_DOCUMENT_INTELLIGENCE_ENDPOINTYes for document analysisAzure Document Intelligence endpointNo
AZURE_DOCUMENT_INTELLIGENCE_KEYYes for document analysisAzure Document Intelligence keyYes
MICROSOFT_CLIENT_IDYes for Azure SP flowsAzure service principal client IDSensitive
MICROSOFT_TENANT_IDYes for Azure SP flowsAzure tenant IDSensitive
MICROSOFT_CLIENT_SECRETYes for Azure SP flowsAzure service principal secretYes
STORAGE_ACCOUNT_NAMEYes for storageAzure Storage account nameNo
STORAGE_CONTAINER_NAMEYes for storageAzure Storage container nameNo
DB_URLYesDatabase host/URLSensitive
DB_USERYesDatabase usernameSensitive
DB_PASSWORDYesDatabase passwordYes
DB_NAMEYesDatabase nameNo
API_ENDPOINTEnvironment-dependentPublic API endpoint metadataNo
CLERK_FRONTEND_APIYesClerk issuer/JWKS base URLNo
CLERK_SECRET_KEYYes for Clerk server callsClerk backend secretYes
CLERK_AUTHORIZED_PARTIESRecommendedComma-separated allowed azp valuesNo
ENVIRONMENTRecommendedControls CORS/security behavior: development, staging, productionNo

Frontend

VariableRequiredPurposeSecret
VITE_APP_API_URLYesBackend API base URLNo
VITE_CLERK_PUBLISHABLE_KEYYesClerk browser publishable keyNo
VITE_CLERK_BILLING_PLAN_IDIf billing UI enabledClerk plan IDNo
VITE_CLERK_BILLING_PLAN_PERIODIf billing UI enabledBilling period used by UINo

Vite exposes VITE_* variables to the browser. Never put secrets in frontend environment variables.

Environment Sources

  • Local backend: copy backend/py/env.example to the local .env used by backend/py/main.py.
  • Local frontend: copy frontend/env.example to frontend/.env.
  • Azure DevOps: variable groups are selected by branch: dev, showcase, prod.
  • Production-grade secrets should live in Key Vault or protected variable groups.

Change Process

  • Adding a required env var must update this page, the relevant env.example, pipeline variable group, and deployment notes.
  • Removing or renaming an env var requires a staged rollout when old containers may still read the previous name.
  • Treat provider keys and DB credentials as rotation-capable; document rotation steps if they differ by provider.
CI/CD RunbookDatabase Operations